Trog::TOTP Predictable Secret Generation Vulnerability in Perl

A vulnerability exists in Trog::TOTP versions prior to 1.006 for Perl, where the library generates secrets using the built-in rand function. This method of random number generation is predictable and not suitable for secure applications. The issue has been addressed in version 1.006, which replaces the built-in rand with Crypt::PRNG::rand, a more secure alternative.

Impact

The vulnerability allows for the generation of predictable secrets, which could be exploited in scenarios where secret randomness is critical, such as in time-based one-time password (TOTP) generation.

Remediation

Users can upgrade to Trog::TOTP version 1.006 or later to address this vulnerability.